Part 1: Explore Local Group Policy Settings

In this exercise, you will explore Group Policies at both the local and domain level. You will first use the Local Group Policy Editor to explore some common Group Policy Settings. You will then apply and test some basic restrictions to your lab workstation.

1. On the Windows taskbar, type group in the Search field, then select Edit group policy from the results to open the Local Group Policy Editor.
   

   

2. In the navigation pane on the left, under Computer Configuration, expand Windows Settings, then select Scripts (Startup/Shutdown).
   

   

   In the configuration pane on the right, you will see where you can configure both startup and shutdown scripts. As you might guess, these scripts will run when the system starts up or just before the system shuts down.
   
3. In the Local Group Policy Editor navigation pane, expand Security Settings > Account Policies, then select Password Policy.
   
   With these policies, you can customize password security for local accounts on this Windows server. Take note of the defaults.
   

   

4. In the Local Group Policy Editor navigation pane, select Account Lockout Policy.
   
   With these policies, you can configure when a user account is locked out due to password failures and when it will unlock.
   

   

5. In the Local Group Policy Editor navigation pane, under User Configuration, expand Windows Settings, then select Scripts (Logon/Logoff).
   
   With these policies, you can configure both logon and logoff scripts. These scripts will run when any user logs in or logs off.
   

   

   Now that we have explored the Local Group Policy Editor interface, it's time to observe Group Policy in action. In the next steps, you will apply the following restrictions to your lab workstation.
   
   -Users should not have access to the Control Panel.
   -Users should not be able to change the Taskbar.
   -Users should not have access to the registry.
   -Users should not have access to the Security tab.
   -There should be no balloon popups.
6. In the Local Group Policy Editor navigation pane, under User Configuration, expand Administrative Templates, then select Control Panel.
   

   

7. In the Local Group Policy Editor configuration pane, double-click Prohibit access to Control Panel and PC Settings.
   
   Take note of what this policy does in the Help section.
   

   

8. In the Prohibit access to Control Panel and PC Settings window, click the Enabled radio button, then click OK to close the window.
   
   Notice in the configuration pane that the status for Prohibit access to Control Panel and PC Settings has changed from Not configured to Enabled.
   
9. In the Local Group Policy Editor navigation pane, under Administrative Templates, select Start Menu and Taskbar, then enable the following policy:
   
   -Turn off all balloon notifications.
   
10. In the Local Group Policy Editor navigation pane, under Administrative Templates, select System, then enable the following policy:
    
    -Prevent access to registry editing tools
    
11. In the Local Group Policy Editor navigation pane, under Administrative Templates, expand Windows Components and select File Explorer, then enable the following policy:
    
    -Remove Security tab.
    
12. On the taskbar, right-click the Start icon, then select Windows PowerShell (Admin) to open an elevated PowerShell window.
    
    When prompted, click Yes to continue.
    
13. In the PowerShell window, type gpupdate /force and press Enter to apply the newly enabled Local Group policies immediately.
    
    Now let's test some of our new policy settings.
    
14. In the PowerShell window, type regedit and press Enter.
    
    Take note of the message you receive. Click OK to close the message.
    
15. In the search field, type control, then click Control Panel.
    
    Click OK to close the message.

Part 2: Explore Domain-Level Group Policy Settings

In this part of the lab, we will explore how Group Policy works in an Active Directory environment.

First, we will need to promote your lab server to a Domain Controller. Leave the elevated PowerShell window open, but close all other open windows.

1. In the PowerShell window, type cd C:\Users\cybrary\Desktop and press Enter to change directories.
   
2. At the PowerShell prompt, type Import-Module .\Install-AD.ps1 and press Enter to import the Install-AD module.
   
   This module will help us install Active Directory quickly.
   
3. At the PowerShell prompt, type Invoke-ADInstaller -DomainName cybrary.local and press Enter to run the AD installer and create a domain titled cybrary.local.
   
   When prompted for the Safe Mode Administrator Password, type P@ssw0rd! and press Enter.
   

   

   Wait for Active Directory to install. The system will then reboot. After you are disconnected, wait 30-60 seconds, then reconnect to Windows 2022.
4. Open an elevated PowerShell window, then execute Add-ADGroupMember -Identity "Domain Admins" -Members "cybrary" to add user cybrary to the Domain Administrators group.
   
   We will need elevated permissions to edit and create domain-level Group Policies. Confirm your work with the Get-ADGroupMember -Identity "Domain Admins" command.
   

   

   We will need to log off and back on for our new group membership to take effect.
5. Right-click the Start icon, click Shut down or sign out, then select Sign out.
   
   After you are disconnected, wait 30-60 seconds, then reconnect to Windows 2022. You may need to refresh your local browser.
   
6. On the taskbar, type group policy in the Search field, then select Group Policy Management from the results to open the Group Policy Management Console.
   
7. In the GPMC navigation pane, navigate to Group Policy Management > Forest: cybrary.local > Domains > cybrary.local, then select the Linked Group Policy Objects tab in configuration pane.
   

   

   Notice there is a single Group Policy Object (GPO) linked to the domain, called Default Domain Policy.
8. In the GPMC configuration pane, right-click the Default Domain Policy and select Edit.
   
   This action will open the Group Policy Management Editor. Notice that the Group Policy Management Editor looks much like the Local Group Policy Editor. It also contains many of the same settings. In the next steps, we will explore the relationship between Domain-level and Local Group Policy.
   
   Note: If the Edit button is grayed out, you must sign out and log back in.
   
9. In the Group Policy Management Editor navigation pane, under User Configuration, expand Policies > Administrative Templates, then select Control Panel.
   

   

10. Enable the Prohibit access to the Control Panel and PC settings policy.
    
11. Open an elevated PowerShell window, then execute gpupdate /force to apply the new policy.
    
12. On the taskbar, type Control in the Search field, then select Control Panel from the results.
    
    Notice that, once again, Group Policy blocks this action.
    
13. On the taskbar, type gpedit in the Search field, then select Edit Group Policy from the results to re-open the Local Group Policy Editor.
    
    Note:  Should you look, you would find that all the Local Policies we configured earlier are gone. The promotion process removes all local policies when a system is promoted to a Domain Controller.
    
14. In the Local Group Policy Editor navigation pane, under User Configuration, expand Administrative Templates, then select Control Panel.
    
15. Disable the Prohibit access to the Control Panel and PC settings policy.
    
    This policy allows access to the Control Panel.
    
16. In the open PowerShell window, execute gpupdate /force to apply the new policy.
    
17. At the PowerShell prompt, type gpresult /Z and press Enter to generate an RSoP report, then scroll up to the Administrative Templates section.
    
    You should see from the gpresult output that the Local Group and Default Domain policies are in conflict. The Local GPO allows access to the Control panel, but the Default Domain Policy denies access. Which policy takes precedence? Try accessing the Control Panel again.

Part 3: Create an OU Structure

In the final part of this exercise, we will create an OU structure and apply GPOs to it.

1. In the open PowerShell Window, type New-ADOrganizationalUnit -Name "Cybrary" -Path "DC=cybrary,DC=local" and press Enter to create a new OU in the cybrary.local domain.
   
2. Next, create the following OUs under the Cybrary OU:  IT, Sales, Engineering, and Contractors.  The command is:
   
   New-ADOrganizationalUnit -Name "[OU NAME]" -Path "OU=Cybrary,DC=cybrary,DC=local"
   

   

3. Close the open GPMC and any open Group Policy Management Editor windows.
   
4. On the taskbar, type group policy in the Search field, then select Group Policy Management from the results.
   
5. In the GPMC navigation pane, expand Forest: cybrary.local > Domains > cybrary.local > Cybrary.
   

   

   You will see the new OU structure we just created. If you click the Cybrary OU, you should notice that no GPOs are currently linked to it.
   
6. In the GPMC navigation pane, right-click the Cybrary OU and select Create a GPO in this domain, and Link it here… to open the New GPO dialog box.
   

   

7. In the New GPO dialog box, name the GPO Cybrary-All-Users and click OK.
   
   A new GPO called Cybrary-All-Users is created and linked to the Cybrary OU. This policy will apply to domain objects placed in the Cybrary OU as well as all OUs contained under Cybrary. The OUs under Cybrary will inherit GPO settings from the Cybrary-All-Users GPO.
   
   The name of the GPO suggests whatever policies we configure should apply to all users. We could also create a new GPO called Cybrary-All-Desktops for desktop policies and Cybrary-All-Servers for server policies.
   
   As a best practice, policies that apply to everyone should flow downward via inheritance. Granular policies, applied directly to child OUs, are used for exceptions and special cases.
   
8. In the GPMC navigation pane, right-click the Engineering OU, select Create a GPO in this domain, and Link it here… to open the New GPO dialog box.
   
9. In the New GPO dialog box, name the GPO Disable-Windows-Update and click OK.
   
   In this example, we have created a granular policy that tells us by its name what it does (or should do). We would not expect this policy to do anything else. By placing this policy on the Engineering OU, we are essentially telling other admins that the Engineers need/want to have forced Windows Updates disabled. The policies attached to the Engineering OU will override inherited policies if there is a conflict.
   
   Note that simply naming a GPO does not make the GPO do anything. It is up to the system administrator to configure policies that match the naming convention. In the next steps, we will do that for our Engineering GPO.
   
10. In the GPMC navigation pane, select the Engineering OU.
    
11. In the configuration pane, right-click the Disable-Windows-Update GPO and select Edit.
    
    This action will open the Group Policy Management Editor.
    
12. In the Group Policy Management Editor navigation pane, under Computer Configuration, expand Policies > Administrative Templates > Windows Components, then click Windows Update.
    

    

13. Disable the following policy:
    
    - Configure Automatic Updates
    
14. Close the Group Policy Management Editor.
    
    Next, we will use the Group Policy Modeling tool in the GPMC to see what GPOs get applied to the Engineering OU.
    
15. In the GPMC navigation pane, right-click Group Policy Modeling and select Group Policy Modeling Wizard.
    

    

16. On the Welcome to the Group Policy Modeling Wizard page, click Next to continue.
    
17. On the Domain Controller Selection page, click Next to accept the default and continue.
    
18. On the User and Computer Selection page, in the Computer Information section, use the Browse button to select the Engineering OU.
    
    Take note of the resulting Container name.
    
19. On the User and Computer Selection page, check the Skip to the final page of this wizard without collecting additional data check-box, then click Next to continue.
    
20. On the Summary of Selections page, click Next to continue.
    
21. On the Completing the Group Policy Modeling Wizard page, click Finish to continue.
    
    When prompted, click Close to dismiss the Internet Explorer message.
    
22. In the configuration pane of the GPMC, review the Group Policy Report.
    
    You should notice that the Disable-Windows-Update policy is applied to the Engineering OU (it is the “Winning” GPO).
    
    Congratulations on completing the guided exercise. You first explored Local Group Policies, and then, after building a new domain, you explored domain-level Group Policies using the GPMC and the Group Policy Management Editor. Finally, you created an OU structure and applied intuitive GPOs to it. You are now ready for a challenge!